Nginx Reverse Proxy Configuration#

Dify ships a fully template-driven Nginx setup under docker/nginx/ that fronts all services in the default Docker Compose deployment. It is not intended to be edited directly — all knobs are exposed as environment variables consumed at container startup.

File Map#

Key Proxy Settings (proxy.conf.template)#

All location blocks include proxy.conf 1, which enforces three important settings:

• proxy_buffering off — disables Nginx's response buffer. This is critical for Server-Sent Events (SSE) streams used by the workflow debug console and chat streaming endpoints; buffering would hold data until the buffer fills, breaking real-time delivery. 1
• proxy_http_version 1.1 + Connection "" — enables HTTP/1.1 keepalive to upstream, required for efficient connection reuse and correct chunked-transfer-encoding handling. 2
• X-Forwarded-* headers — Host, X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Port are all forwarded so backend services can reconstruct the original client request context. 3

Timeouts are long by design — both proxy_read_timeout and proxy_send_timeout default to 3600s 4 to accommodate long-running LLM completions and workflow executions.

Routing (default.conf.template)#

The server block maps URL prefixes to three upstream services 5:

All upstreams use dynamic DNS resolution: a server-level resolver (127.0.0.11, the Docker embedded DNS, with 30s validity) 6 and $variable-based proxy_pass directives 7 prevent Nginx from caching incorrect upstream IPs at startup — a problem that can occur when the host's DNS search domains resolve short service names (api, web) to external addresses instead of Docker containers after restarts.

Environment Variables#

Configured via .env (or docker/envs/infrastructure/nginx.env.example as reference) 7:

Startup Process#

docker-entrypoint.sh runs envsubst over all templates at container start 8. If NGINX_HTTPS_ENABLED=true, it additionally resolves the correct certificate path — checking /etc/letsencrypt/live/<domain>/ first (Certbot), falling back to /etc/ssl/ — and injects the rendered https.conf.template snippet into the server block 9.

Operational Notes#

• Do not edit .conf files directly — they are overwritten on every container restart by envsubst. Edit the corresponding .env variable instead 10.
• Plugin uploads and large bodies — the default client_max_body_size 100M 11 gates plugin package uploads. If the Nginx log shows a client request body is buffered to a temporary file warning, the request body exceeded nginx's in-memory buffer but will still complete; this is not a failure.
• External reverse proxy in front of Dify's Nginx — if you add another proxy layer (e.g., Cloudflare, another Nginx), ensure it also sets proxy_buffering off (or equivalent) and long timeouts for the /console/api and /v1 paths; buffering at that layer will break SSE streaming even if Dify's internal Nginx is configured correctly. The Host header should use $http_host (not $host) if non-standard ports are in use.
• Chunked transfer encoding — because proxy_buffering off is set globally, Nginx passes chunked responses from the API directly to the client without accumulating them, which is the correct behavior for streaming endpoints. If buffering were enabled without an explicit Content-Length, Nginx would fail to set the header and could prematurely close connections.